private static async Task Run(Service service)
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
string savedSearchName = "example_search";
string savedSearchQuery = "search index=_internal | head 10";
// Delete the saved search if it exists before we start.
SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(savedSearchName);
if (savedSearch != null)
{
await savedSearch.RemoveAsync();
}
savedSearch = await service.SavedSearches.CreateAsync(savedSearchName, savedSearchQuery);
Job savedSearchJob = await savedSearch.DispatchAsync();
using (SearchResultStream stream = await savedSearchJob.GetSearchResultsAsync())
{
foreach (SearchResult result in stream)
{
Console.WriteLine(result);
}
}
await savedSearch.RemoveAsync();
}
/// <summary>
/// Asynchronously dispatches a <see cref="SavedSearch"/> just like the
/// scheduler would.
/// </summary>
/// <param name="name">
/// The name of the <see cref="SavedSearch"/> to dispatch.
/// </param>
/// <param name="dispatchArgs">
/// A set of arguments to the dispatcher.
/// </param>
/// <param name="templateArgs">
/// A set of template arguments to the <see cref="SavedSearch"/>.
/// </param>
/// <returns>
/// The search <see cref="Job"/> that was dispatched.
/// </returns>
/// <remarks>
/// This method uses the <a href="http://goo.gl/AfzBJO">POST
/// saved/searches/{name}/dispatch</a> endpoint to dispatch the <see
/// cref="SavedSearch"/> identified by <see cref="name"/>.
/// </remarks>
public async Task<Job> DispatchSavedSearchAsync(string name, SavedSearchDispatchArgs dispatchArgs = null,
SavedSearchTemplateArgs templateArgs = null)
{
var savedSearch = new SavedSearch(this.Context, this.Namespace, name);
var job = await savedSearch.DispatchAsync(dispatchArgs, templateArgs);
return job;
}
public async Task SavedSearchHistory()
{
using (var service = await SdkHelper.CreateService())
{
const string name = "sdk-test_SavedSearchHistory";
const string search = "search index=sdk-tests * earliest=-1m";
SavedSearchCollection savedSearches = service.SavedSearches;
await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter {
Count = 0, SortDirection = SortDirection.Descending
});
SavedSearch savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name);
if (savedSearch != null)
{
await savedSearch.RemoveAsync();
}
// Create a saved search
savedSearch = await savedSearches.CreateAsync(name, search);
// Clear the history - even though we have a newly create saved search
// it's possible there was a previous saved search with the same name
// that had a matching history.
JobCollection history = await savedSearch.GetHistoryAsync();
foreach (Job job in history)
{
await job.CancelAsync();
}
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
Job job1 = await savedSearch.DispatchAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid));
Job job2 = await savedSearch.DispatchAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(2, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid));
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job1.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job2.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
//// Delete the saved search
await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter {
Count = 0, SortDirection = SortDirection.Descending
});
savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name);
Assert.NotNull(savedSearch);
await savedSearch.RemoveAsync();
savedSearch = await savedSearches.GetOrNullAsync(savedSearch.Name);
Assert.Null(savedSearch);
}
}
public async Task SavedSearchDispatchProperties()
{
using (var service = await SdkHelper.CreateService())
{
// Ensure correct start state
SavedSearchCollection savedSearches = service.SavedSearches;
string name = "sdk-test_DispatchProperties";
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
await savedSearches.GetAllAsync();
Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name));
// Create a saved search
testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m");
// Dispatch the saved search with default arguments
Job job = await testSearch.DispatchAsync();
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchBuckets = 100
});
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchEarliestTime = "aaaa"
});
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
var savedSearchTemplateArgs = new SavedSearchTemplateArgs(
new Argument("action.email.authpassword ", "sdk-password"),
new Argument("action.email.authusername ", "sdk-username"),
new Argument("action.email.bcc ", "*****@*****.**"),
new Argument("action.email.cc ", "*****@*****.**"),
new Argument("action.email.command ", "$name1$"),
new Argument("action.email.format ", "text"),
new Argument("action.email.from ", "*****@*****.**"),
new Argument("action.email.hostname ", "dummy1.host.com"),
new Argument("action.email.inline ", "true"),
new Argument("action.email.mailserver ", "splunk.com"),
new Argument("action.email.maxresults ", "101"),
new Argument("action.email.maxtime ", "10s"),
new Argument("action.email.pdfview ", "dummy"),
new Argument("action.email.reportpaperorientation ", "landscape"),
new Argument("action.email.reportpapersize ", "letter"),
new Argument("action.email.reportserverenabled ", "false"),
new Argument("action.email.reportserverurl ", "splunk.com"),
new Argument("action.email.sendpdf ", "false"),
new Argument("action.email.sendresults ", "false"),
new Argument("action.email.subject ", "sdk-subject"),
new Argument("action.email.to ", "*****@*****.**"),
new Argument("action.email.trackalert ", "false"),
new Argument("action.email.ttl ", "61"),
new Argument("action.email.usessl ", "false"),
new Argument("action.email.usetls ", "false"),
new Argument("action.email.widthsortcolumns ", "false"),
new Argument("actions.populatelookup.command ", "$name2$"),
new Argument("actions.populatelookup.dest ", "dummypath"),
new Argument("actions.populatelookup.hostname ", "dummy2.host.com"),
new Argument("actions.populatelookup.maxresults ", "102"),
new Argument("actions.populatelookup.maxtime ", "20s"),
new Argument("actions.populatelookup.trackalert ", "false"),
new Argument("actions.populatelookup.ttl ", "62"),
new Argument("actions.rss.command ", "$name3$"),
new Argument("actions.rss.hostname ", "dummy3.host.com"),
new Argument("actions.rss.maxresults ", "103"),
new Argument("actions.rss.maxtime ", "30s"),
new Argument("actions.rss.trackalert ", "false"),
new Argument("actions.rss.ttl ", "63"),
new Argument("actionscriptcommand ", "$name4$"),
new Argument("actionscriptfilename ", "action_script_filename"),
new Argument("actionscripthostname ", "dummy4.host.com"),
new Argument("actionscriptmaxresults ", "104"),
new Argument("actionscriptmaxtime ", "40s"),
new Argument("actionscripttrackalert ", "false"),
new Argument("actionscriptttl ", "64"),
new Argument("actions.summaryindex.command ", "$name5$"),
new Argument("actions.summaryindex.hostname ", "dummy5.host.com"),
new Argument("actions.summaryindex.inline ", "false"),
new Argument("actions.summaryindex.maxresults ", "105"),
new Argument("actions.summaryindex.maxtime ", "50s"),
new Argument("actions.summaryindex.trackalert ", "false"),
new Argument("actions.summaryindex.ttl ", "65"),
new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
//// Same as the previous dispatch except using custom arg
job = await testSearch.DispatchAsync(templateArgs : savedSearchTemplateArgs);
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.Null(testSearch);
}
}
public async Task SavedSearchHistory()
{
using (var service = this.Connect())
{
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = await service.GetSavedSearchesAsync(
new SavedSearchCollectionArgs { Count = 0 });
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
await service.RemoveSavedSearchAsync(savedSearchTitle);
await savedSearches.GetAsync();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
SavedSearch savedSearch = await service.CreateSavedSearchAsync(savedSearchTitle,
new SavedSearchAttributes()
{
Search = search
});
// Clear the history - even though we have a newly create saved search
// it's possible there was a previous saved search with the same name
// that had a matching history.
JobCollection history = await savedSearch.GetHistoryAsync();
foreach (Job job in history)
{
await job.CancelAsync();
}
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
Job job1 = await savedSearch.DispatchAsync();
this.Ready(job1);
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid));
Job job2 = await savedSearch.DispatchAsync();
this.Ready(job2);
history = await savedSearch.GetHistoryAsync();
Assert.Equal(2, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid));
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job1.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job2.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
//// Delete the saved search
await service.RemoveSavedSearchAsync("sdk-test1");
await savedSearches.GetAsync();
Assert.False(savedSearches.Any(a => a.Name == "sdk-test1"));
}
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch =
service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes()
{
Search = search
}).Result;
// Dispatch the saved search and wait for results.
Job job = savedSearch.DispatchAsync().Result;
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchBuckets = 100
}).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchEarliestTime = "aaaa"
}).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs();
if (this.VersionCompare(service, "6.0") < 0)
{
savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password"));
savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username"));
savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$"));
savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text"));
savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true"));
savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s"));
savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject"));
savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61"));
savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63"));
savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$"));
savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename"));
savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s"));
savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65"));
savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
}
//// Same as the previous dispatch except using custom arg
job = savedSearch.DispatchAsync(null, savedSearchTemplateArgs).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Delete the saved search
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}